Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-12-2024 20:36
General
-
Target
Transfer.exe
-
Size
292KB
-
MD5
ff69fbff0010db34c0ee5a506f4c4edd
-
SHA1
169029f0020cecac813206edb8256fe1e518d6d5
-
SHA256
92c11098030f01c5c024f7b9f026b9006d193c4ac5b1be6dae5cc54d17be1628
-
SHA512
f0a03ce79e282fd30f780fb8d0e379d33ca791bea8700bf84bd2645155482cce914b0580f6ce6f335539a41d1a60e387d83b7ce4f9c2c8660252a76555bb6760
-
SSDEEP
6144:e1o12lUr7EbaK1fw9mlH3hzo7DZJ/wDAUZlYm3UhM9l:eC1ZobTw9/DZJwDrPYmO
Malware Config
Extracted
metasploit
windows/reverse_http
http://89.197.154.116:7810/OGgACk8WohpIa0lqLzBQpQIBiTvAZrdP1D8niB7YqBY3pBjtYmWYJw1WQE1b54johKnf_2Na8Ev9r9AMjiuPjapALWcWpvyxUeyyd4afbejN3E1XqB5_041iqTXmxcKVjfJUOoqhxWbatZmmMI9D6UcbYSNUPD4DaSiVVP3p2OhuOWhsYcBPOYSQTYQjPNKrXbbYQOJ8axlN-Ud-iOXPGR16ZZxgTpE4MHvC_4czGI
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transfer.exe"C:\Users\Admin\AppData\Local\Temp\Transfer.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB